Safety-critical Embedded Applications Research Articles

Boosting Bit-Error Resilience of DNN Accelerators Through Median Feature Selection

Deep learning techniques have enjoyed wide adoption in real life, including in various safety-critical embedded applications. While neural network computations require protection against hardware errors, the substantial overheads of conventional error-tolerance techniques limit their use on embedded platforms, which carry out demanding deep neural network computations with limited resources. The utilization of conventional techniques is further constrained in high error rate scenarios, increasingly prevalent under aggressive energy and performance optimizations. To resolve this conundrum, we introduce a novel median feature selection technique to filter the impact of bit errors prior to the execution of each layer. While our technique can be deemed as a fine-grained modular redundancy scheme, its construction purely out of the inherent redundancy of the network necessitates neither additional parameters nor extra multiply-accumulate operations, squashing the inordinate overheads typically associated with such techniques. Median feature selection can be efficiently performed in hardware and seamlessly integrated into embedded deep learning accelerators as a modular plug-in. Deep learning models can be trained with standard tools and techniques to ensure a graceful operational interface with the feature selection stages. The proposed technique allows the system to perform accurately even at high error rates by improving its resilience up to four orders of magnitude, yet incurs negligible 0.19%–0.48% area and 0.07%–0.19% power overheads for the required operations.

Introducing Model-based Design Methodology with LabVIEW to Teaching ARM-based Embedded System Design

This paper presents our latest experience of introducing the new topic of model-based design (MBD) concepts and tools to a Programming Tools (PT) course for educating students to be capable of utilizing modern tools for correctly developing complicated ARM-based embedded systems. It describes the course contents, student outcomes and lecture and lab preparation for teaching this topic with the emphasis on two sub-topics. Firstly, we present the details of using NI LabVIEW tool in programming ARM Cortex-M MCUs or ARM Cortex-A9 MCUs on the embedded device like NI myRIO for fast developing embedded applications. Secondly, to integrate an on-going research effort on the model-based verification into this course, we also introduce model-checking and the tools that have been utilized in the research project. This new topic helps introducing students the latest research advances which promote the wide applications of the MBD in safety-critical embedded applications. Our primary experience shows that the project-based learning approach with the graphical programming tools and selected MCUs is efficient and practical to teach the MBD of 32-bit MCUs programming.

An Analysis of the Composition of Synchronous Systems

Safety-critical embedded applications are often distributed. For example, software in an automotive control or in avionics control are distributed over a large number of distributed processors which are connected over some domain specific buses. Correctness of such applications is of paramount importance due to their safety-critical nature. Synchronous programming models (e.g. Esterel, SIGNAL, Lustre) make synchrony assumption (zero time intra-module computation and zero time inter module communication) while modeling such applications so that the model is easier to verify. Once verified, models built with such assumptions need to be distributed over an asynchronous communication based platform which brings out the challenge of Globally Asynchronous and Locally synchronous (GALS) design. The correctness preserving refinement of a fully synchronous model onto a globally asynchronous communication media implies that various restrictions be imposed on the synchronous model. In the realm of polychronous programming model (exemplified by the SIGNAL language), a property called ‘endo-isochrony’ was proposed in early 1990s. Endochrony of individual modules assures safe sequential code generation from the module specification, and isochrony ensures safe communication between modules. In this paper, first we provide a more general sufficient condition for isochrony. Second, we generalize the definition of isochrony for weakly-endochronous modules. Further, we introduce the notion of directional isochrony which provides sufficient conditions for safe communication between modules in one direction but not in the other direction. The results in this paper not only simplifies the understanding of the conditions under which a polychronous specification can be implemented in GALS, but also sheds interesting lights on causality and isochrony. When the synchronous modules are reused as IPs, the conditions described here can be checked to see whether those modules can be composed asynchronously with the same behavior as their synchronous composition.

Components to Enforce Fail-Silent Behavior in Dynamic Master-Slave Systems

This paper considers the case in which master-slave fieldbus networks are used in safety-critical embedded applications, such as transportation systems. Traditional approaches to system design, due to fault-tolerance reasons, have considered static cyclic table-based traffic scheduling, only. However, there is a growing demand for flexibility and integration, mainly to improve efficiency in the use of system resources, with the network playing a central role to support such properties. This calls for dynamic on-line traffic scheduling techniques so that dynamic communication requirements are adequately supported. This paper considers such dynamic master-slave architectures and addresses the problem of enforcing fail silent behavior both in the master and in the slave nodes. Two different mechanisms are proposed, one based on dynamic bus guardians for the slave nodes only, to impose fail silent behavior in the time domain, and other based on internal replication and temporized agreement, to impose fail silence both in the temporal and value domains. Despite being potentially applicable to a set of master-slave networks, this paper discusses the specific implementation of the proposed mechanisms on top of the FTT-CAN protocol.